Commit Graph

12 Commits

Author SHA1 Message Date
Aaron Lehmann 762a73bf7f Split advertised address from listen address
There are currently problems with "swarm init" and "swarm join" when an
explicit --listen-addr flag is not provided. swarmkit defaults to
finding the IP address associated with the default route, and in cloud
setups this is often the wrong choice.

Introduce a notion of "advertised address", with the client flag
--advertise-addr, and the daemon flag --swarm-default-advertise-addr to
provide a default. The default listening address is now 0.0.0.0, but a
valid advertised address must be detected or specified.

If no explicit advertised address is specified, error out if there is
more than one usable candidate IP address on the system. This requires a
user to explicitly choose instead of letting swarmkit make the wrong
choice. For the purposes of this autodetection, we ignore certain
interfaces that are unlikely to be relevant (currently docker*).

The user is also required to choose a listen address on swarm init if
they specify an explicit advertise address that is a hostname or an IP
address that's not local to the system. This is a requirement for
overlay networking.

Also support specifying interface names to --listen-addr,
--advertise-addr, and the daemon flag --swarm-default-advertise-addr.
This will fail if the interface has multiple IP addresses (unless it has
a single IPv4 address and a single IPv6 address - then we resolve the
tie in favor of IPv4).

This change also exposes the node's externally-reachable address in
docker info, as requested by #24017.

Make corresponding API and CLI docs changes.

Signed-off-by: Aaron Lehmann <aaron.lehmann@docker.com>
(cherry picked from commit a0ccd0d42fdb0dd2005f67604cb81a5a6b26787e)
Signed-off-by: Tibor Vass <tibor@docker.com>
2016-07-25 23:18:03 -07:00
Andrea Luzzardi e6464aa5ab CLI: Change default Swarm task history retention limit.
Signed-off-by: Andrea Luzzardi <aluzzardi@gmail.com>
(cherry picked from commit d97c0a1f253fe61957047ea4b21d9e764dc7d783)
Signed-off-by: Tibor Vass <tibor@docker.com>
2016-07-25 23:17:34 -07:00
Aaron Lehmann 5d7a3f7b5f Replace secrets with join tokens
Implement the proposal from
https://github.com/docker/docker/issues/24430#issuecomment-233100121

Removes acceptance policy and secret in favor of an automatically
generated join token that combines the secret, CA hash, and
manager/worker role into a single opaque string.

Adds a docker swarm join-token subcommand to inspect and rotate the
tokens.

Signed-off-by: Aaron Lehmann <aaron.lehmann@docker.com>
(cherry picked from commit 2cc5bd33eef038bf5721582e2410ba459bb656e9)
Signed-off-by: Tibor Vass <tibor@docker.com>
2016-07-25 23:16:59 -07:00
johnharris85 c0a787db2b Add support for comma-separated --auto-accept syntax.
Signed-off-by: John Harris <john@johnharris.io>

(cherry picked from commit 8e148827734a94165156adfd0f6d202d28dff142)
Signed-off-by: Tibor Vass <tibor@docker.com>
2016-07-12 15:50:36 -07:00
Aaron Lehmann a00d12a8dd Generate a swarm joining secret if none is specified
The current behavior of `docker swarm init` is to set up a swarm that
has no secret for joining, and does not require manual acceptance for
workers. Since workers may sometimes receive sensitive data such as pull
credentials, it makes sense to harden the defaults.

This change makes `docker swarm init` generate a random secret if none
is provided, and print it to the terminal. This secret will be needed to
join workers or managers to the swarm. In addition to improving access
control to the cluster, this setup removes an avenue for
denial-of-service attacks, since the secret is necessary to even create
an entry in the node list.

`docker swarm init --secret ""` will set up a swarm without a secret,
matching the old behavior. `docker swarm update --secret ""` removes the
automatically generated secret after `docker swarm init`.

Closes #23785

Signed-off-by: Aaron Lehmann <aaron.lehmann@docker.com>
(cherry picked from commit 7342e42fcecbc243bcb8723b8422879662452017)
Signed-off-by: Tibor Vass <tibor@docker.com>
2016-07-08 15:33:27 -07:00
Tonis Tiigi f9f7abfffe Add support for external CAs
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
(cherry picked from commit 11085b2260a78b3248f3e98e0a1e3203431fae22)
2016-07-01 00:40:37 -07:00
Tonis Tiigi 3d06cd4910 Unify swarm init and update options
Add api side validation and defaults for init and
join requests.

Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
(cherry picked from commit fb3eb1c27ef5520571c599ead8a72b343748db39)
2016-06-30 16:47:44 -07:00
Daniel Nephin 3c35da6029 Add tests for AutoAcceptOption
Signed-off-by: Daniel Nephin <dnephin@docker.com>
(cherry picked from commit c544649874bfecf2e6b8a00a0b25db309d81cf94)
2016-06-18 20:58:24 -07:00
Daniel Nephin e090e2dbd4 Support a listen addr without a port, and add tests.
Signed-off-by: Daniel Nephin <dnephin@docker.com>
(cherry picked from commit 595e79b805fd6e96d2e6c8876f7c9734164f5db7)
2016-06-18 20:58:24 -07:00
Justin Cormack b7a1f1a2d1 fix invalid typo in error message
Signed-off-by: Justin Cormack <justin.cormack@docker.com>
(cherry picked from commit 2322ccb8fff46a4d3a84f3ef214cb473816374af)
2016-06-17 13:09:11 -07:00
Victor Vieux 7cc76facba fix docker swarm init/update --secret
Signed-off-by: Victor Vieux <vieux@docker.com>
(cherry picked from commit 085895342c7f797f0eef7ec956438e33489f211f)
2016-06-16 23:36:54 -07:00
Daniel Nephin 12a00e6017 Add Swarm management CLI commands
As described in our ROADMAP.md, introduce new Swarm management commands
to call to the corresponding API endpoints.

This PR is fully backward compatible (joining a Swarm is an optional
feature of the Engine, and existing commands are not impacted).

Signed-off-by: Daniel Nephin <dnephin@docker.com>
Signed-off-by: Victor Vieux <vieux@docker.com>
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
2016-06-13 22:17:15 -07:00